China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices
An extended assault against an unidentified East Asian organization over a period of approximately three years has been linked to a suspected China-nexus cyber espionage actor. The adversary established persistence using legacy F5 BIG-IP appliances and used it as an internal command-and-control (C&C) for defense evasion.
The behavior is being tracked under the name Velvet Ant by the cybersecurity company Sygnia, which responded to the infiltration in late 2023. The company describes Velvet Ant as having strong ability to quickly pivot and adjust their methods to counter-remediation attempts.
The Israeli company said in a technical study that it provided with The Hacker News that Velvet Ant is an inventive and clever threat actor. Over a protracted length of time, they gathered s...